Blame SOURCES/libarchive-3.1.2-CVE-2015-8919.patch

995285
From e8a2e4d2e6b450a239bb8f9d74239fa434bf7d35 Mon Sep 17 00:00:00 2001
995285
From: Tim Kientzle <kientzle@acm.org>
995285
Date: Sat, 7 Feb 2015 13:32:58 -0800
995285
Subject: [PATCH] Issue 402: Failed to recognize empty dir name in lha/lzh file
995285
995285
When parsing a directory name, we checked for the name
995285
length being zero, but not for the first byte being a
995285
null byte.  Add a similar check for the file case.
995285
---
995285
 libarchive/archive_read_support_format_lha.c | 6 ++++--
995285
 1 file changed, 4 insertions(+), 2 deletions(-)
995285
995285
diff --git a/libarchive/archive_read_support_format_lha.c b/libarchive/archive_read_support_format_lha.c
995285
index 572686a..f8e01af 100644
995285
--- a/libarchive/archive_read_support_format_lha.c
995285
+++ b/libarchive/archive_read_support_format_lha.c
995285
@@ -1194,13 +1194,15 @@ lha_read_file_extended_header(struct archive_read *a, struct lha *lha,
995285
 				archive_string_empty(&lha->filename);
995285
 				break;
995285
 			}
995285
+			if (extdheader[0] == '\0')
995285
+				goto invalid;
995285
 			archive_strncpy(&lha->filename,
995285
 			    (const char *)extdheader, datasize);
995285
 			break;
995285
 		case EXT_DIRECTORY:
995285
-			if (datasize == 0)
995285
+			if (datasize == 0 || extdheader[0] == '\0')
995285
 				/* no directory name data. exit this case. */
995285
-				break;
995285
+				goto invalid;
995285
 
995285
 			archive_strncpy(&lha->dirname,
995285
 		  	    (const char *)extdheader, datasize);
995285
-- 
995285
2.7.4
995285